{
    "test_cases": [
        {
            "name": "Match all nodes in the graph",
            "type": "string_match",
            "details": {
                "query": "match (a) return a",
                "complexity": 3.0
            }
        },
        {
            "name": "Match nodes with the label :Person",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) return p",
                "complexity": 1.0
            }
        },
        {
            "name": "Filter nodes by single label and single property",
            "type": "string_match",
            "details": {
                "query": "match (p:Person {name: 'Tom Hanks'}) return p",
                "complexity": 1.0
            }
        },
        {
            "name": "Filter nodes by single label and single nested property",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) where p.details.name = 'Tom Hanks' return p",
                "complexity": 1.0
            }
        },
        {
            "name": "Filter nodes by multi label and single property",
            "type": "string_match",
            "details": {
                "query": "match (p:Person:Male {name: 'Tom Hanks'}) return p",
                "complexity": 1.0
            }
        },
        {
            "name": "Support filter and quantifier expressions",
            "type": "string_match",
            "details": {
                "query": "match (g:GPO) optional match (g)-[r1:GPLink {enforced: false}]->(container1) with g, container1 optional match (g)-[r2:GPLink {enforced: true}]->(container2) with g, container1, container2 optional match p1 = (g)-[r1:GPLink]->(container1)-[r2:Contains*1..]->(n1:Computer) where none(x in nodes(p1) where x.blocksinheritance = true and labels(x) = 'OU') with g, p1, container2, n1 optional match p2 = (g)-[r1:GPLink]->(container2)-[r2:Contains*1..]->(n2:Computer) return p1, p2",
                "complexity": 39.0
            }
        },
        {
            "name": "Match nodes by multi label and multi property",
            "type": "string_match",
            "details": {
                "query": "match (p:Person:Male {fname: 'Tom', lname: 'Hank'}) return p",
                "matcher": "match \\(p:Person:Male \\{(fname|lname): '(Tom|Hank)', (fname|lname): '(Tom|Hank)'}\\) return p",
                "complexity": 1.0
            }
        },
        {
            "name": "Retrieve single node property",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) return p.name",
                "complexity": 1.0
            }
        },
        {
            "name": "Retrieve nested node property",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) return p.born.year",
                "complexity": 1.0
            }
        },
        {
            "name": "Retrieve multiple node properties",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) return p.fname, p.lname",
                "complexity": 1.0
            }
        },
        {
            "name": "Filter nodes using WHERE clause with equality",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) where p.name = 'Tom Hanks' return p",
                "complexity": 1.0
            }
        },
        {
            "name": "Filter nodes using WHERE clause with < operator",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) where p.age < 50 return p",
                "complexity": 1.0
            }
        },
        {
            "name": "Filter nodes using WHERE clause with > operator",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) where p.age > 50 return p",
                "complexity": 1.0
            }
        },
        {
            "name": "Filter nodes using WHERE clause with <= operator",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) where p.age <= 50 return p",
                "complexity": 1.0
            }
        },
        {
            "name": "Filter nodes using WHERE clause with >= operator",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) where p.age >= 50 return p",
                "complexity": 1.0
            }
        },
        {
            "name": "Filter nodes using WHERE clause with in-equality",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) where p.name <> 'Tom Hanks' return p",
                "complexity": 1.0
            }
        },
        {
            "name": "Filter nodes using WHERE clause with disjunction",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) where (p.fname = 'Tom' or p.fname = 'Brad') return p",
                "complexity": 1.0
            }
        },
        {
            "name": "Filter nodes using WHERE clause with conjuction",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) where p.fname = 'Tom' and p.lname = 'Hanks' return p",
                "complexity": 1.0
            }
        },
        {
            "name": "Traverse relationship by specifying edge type, filter query using where clause",
            "type": "string_match",
            "details": {
                "query": "match (p:Person)-[:ACTED_IN]->(m:Movie) where p.name = 'Tom Hanks' return m",
                "complexity": 2.0
            }
        },
        {
            "name": "Traverse relationship by specifying edge type, filter query using property matcher",
            "type": "string_match",
            "details": {
                "query": "match (p:Person {name: 'Tom Hanks'})-[:ACTED_IN]->(m:Movie) return m",
                "complexity": 2.0
            }
        },
        {
            "name": "Traverse relationship by specifying multiple edge types",
            "type": "string_match",
            "details": {
                "query": "match (p:Person)-[:ACTED_IN|DIRECTED]->(m:Movie) return m",
                "complexity": 2.0
            }
        },
        {
            "name": "Specify left to right relationship",
            "type": "string_match",
            "details": {
                "query": "match (p:Person)-[]->(m:Movie) return m",
                "complexity": 4.0
            }
        },
        {
            "name": "Specify right to left relationship",
            "type": "string_match",
            "details": {
                "query": "match (p:Person)<-[]-(m:Movie) return m",
                "complexity": 4.0
            }
        },
        {
            "name": "Specify bi-directional relationship",
            "type": "string_match",
            "details": {
                "query": "match (p:Person)<-[]->(m:Movie) return m",
                "complexity": 5.0
            }
        },
        {
            "name": "Filter query by specifying node labels in the where clause",
            "type": "string_match",
            "details": {
                "query": "match (p)-[:ACTED_IN]->(m) where p:Person and m:Movie and m.title = 'The Matrix' return p.name",
                "complexity": 2.0
            }
        },
        {
            "name": "Filter using ranges in where clause",
            "type": "string_match",
            "details": {
                "query": "match (p:Person)-[:ACTED_IN]->(m:Movie) where 2000 < m.released < 2003 and 100 > m.last < 200 return p.name",
                "complexity": 2.0
            }
        },
        {
            "name": "Nested property references",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) return p.born.year",
                "complexity": 1.0
            }
        },
        {
            "name": "Filtering by existence of a property",
            "type": "string_match",
            "details": {
                "query": "match (n) where n.doesThisPropertyExist is not null return n",
                "complexity": 3.0
            }
        },
        {
            "name": "Filter by string matching: prefix string search",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) where p.name starts with 'tom' return p",
                "complexity": 1.0
            }
        },
        {
            "name": "Filter by string matching: suffix string search",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) where p.name ends with 'hanks' return p",
                "complexity": 1.0
            }
        },
        {
            "name": "Filter by string matching: substring search",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) where p.name contains 'tom h' return p",
                "complexity": 1.0
            }
        },
        {
            "name": "Filter by string matching: toLower()",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) where toLower(p.name) starts with 'tom' return p",
                "complexity": 1.0
            }
        },
        {
            "name": "Filter by string matching: toUpper()",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) where toUpper(p.name) starts with 'tom' return p",
                "complexity": 1.0
            }
        },
        {
            "name": "Filter by list inclusion: list literal of numeric values",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) where p.born in [1965, 1970, 1975] return p.name, p.born",
                "complexity": 1.0
            }
        },
        {
            "name": "Filter by list inclusion: list literal of string values",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) where p.name in [\"tom\", \"tommy\", \"thomas\"] return p.name, p.born",
                "complexity": 1.0
            }
        },
        {
            "name": "Filter by list inclusion: list comes from the edge property named `r.roles`",
            "type": "string_match",
            "details": {
                "query": "match (p:Person)-[r:ACTED_IN]->(m:Movie) where 'Neo' in r.roles return p.name",
                "complexity": 2.0
            }
        },
        {
            "name": "Query for the properties of a node using keys()",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) return p.name, keys(p)",
                "complexity": 1.0
            }
        },
        {
            "name": "Query for the properties of an edge using keys()",
            "type": "string_match",
            "details": {
                "query": "match ()-[e:EDGE_OF_INTEREST]->() return keys(e)",
                "complexity": 6.0
            }
        },
        {
            "name": "Specify alias in return clause with `AS`",
            "type": "string_match",
            "details": {
                "query": "match (n) return n.property as renamedProperty",
                "complexity": 3.0
            }
        },
        {
            "name": "Retrieve labels for a node using labels()",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) return labels(p)",
                "complexity": 1.0
            }
        },
        {
            "name": "Ordering query results",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) return p order by p.born asc",
                "complexity": 2.0
            }
        },
        {
            "name": "Ordering query results descending",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) return p order by p.born desc",
                "complexity": 2.0
            }
        },
        {
            "name": "Provide multiple sort expressions",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) return p order by p.year asc, p.name desc",
                "complexity": 3.0
            }
        },
        {
            "name": "Limit results",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) return p limit 100",
                "complexity": 1.0
            }
        },
        {
            "name": "Skip results",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) return p skip 100",
                "complexity": 1.0
            }
        },
        {
            "name": "Order, limit, and skip results",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) return p order by p.name asc skip 10 limit 10",
                "complexity": 2.0
            }
        },
        {
            "name": "Eliminate duplicate rows returned",
            "type": "string_match",
            "details": {
                "query": "match (p:Person)-[]->(m:Movie) return distinct p.name, m.title",
                "complexity": 5.0
            }
        },
        {
            "name": "Eliminate duplicate property values",
            "type": "string_match",
            "details": {
                "query": "match (m:Movie) return distinct m.title",
                "complexity": 2.0
            }
        },
        {
            "name": "Aggregation using count()",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) return count(*)",
                "complexity": 1.0
            }
        },
        {
            "name": "Order results by count()",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) return count(*) as total order by total desc",
                "complexity": 2.0
            }
        },
        {
            "name": "Return a list",
            "type": "string_match",
            "details": {
                "query": "match (p:Person) return p.name, [p.born, p.died]",
                "complexity": 1.0
            }
        },
        {
            "name": "Aggregation using collect() to create a list",
            "type": "string_match",
            "details": {
                "query": "match (p:Person)-[:ACTED_IN]->(m:Movie) return p.name, collect(m.title)",
                "complexity": 4.0
            }
        },
        {
            "name": "Eliminate duplication in lists",
            "type": "string_match",
            "details": {
                "query": "match (p:Person)-[:ACTED_IN]->(m:Movie) where m.year = 1920 return collect(distinct (m.title))",
                "complexity": 4.0
            }
        },
        {
            "name": "Collecting nodes",
            "type": "string_match",
            "details": {
                "query": "match (p:Person)-[:ACTED_IN]->(m:Movie) where p.name = 'tom cruise' return collect(m) as tomCruiseMovies",
                "complexity": 4.0
            }
        },
        {
            "name": "built-in shortestPaths()",
            "type": "string_match",
            "details": {
                "query": "match p = shortestPath((p1:Person)<-[*]->(p2:Person)) where p1.name = 'tom' and p2.name = 'jerry' return p",
                "complexity": 9.0
            }
        },
        {
            "name": "Find nodes with property",
            "type": "string_match",
            "details": {
                "query": "match (b) where b.name is not null return b",
                "complexity": 3.0
            }
        },
        {
            "name": "Find nodes with property",
            "type": "string_match",
            "details": {
                "query": "match (b) where b.name is not null return b",
                "complexity": 3.0
            }
        },
        {
            "name": "Find nodes with relationships",
            "type": "string_match",
            "details": {
                "query": "match (b) where (b)<-[]->() return b",
                "complexity": 9.0
            }
        },
        {
            "name": "Find nodes with no relationships",
            "type": "string_match",
            "details": {
                "query": "match (b) where not ((b)<-[]->()) return b",
                "complexity": 9.0
            }
        },
        {
            "name": "Set node properties",
            "type": "string_match",
            "details": {
                "query": "match (b) set b.name = '123' return b",
                "complexity": 3.0
            }
        },
        {
            "name": "Set node properties with map",
            "type": "string_match",
            "details": {
                "query": "match (b) set b += {prop1: '123', lprop: [1, [2, 3, 4], {a: 1234}]} return b",
                "matcher": "match \\(b\\) set b \\+= \\{(prop1: '123', lprop: \\[1, \\[2, 3, 4\\], \\{a: 1234}]|lprop: \\[1, \\[2, 3, 4\\], \\{a: 1234}], prop1: '123')} return b",
                "complexity": 3.0
            }
        },
        {
            "name": "Set node property to null",
            "type": "string_match",
            "details": {
                "query": "match (b) set b.prop = null return b",
                "complexity": 3.0
            }
        },
        {
            "name": "Set node property to other node property",
            "type": "string_match",
            "details": {
                "query": "match (a), (b) set a.prop = b.prop",
                "complexity": 7.0
            }
        },
        {
            "name": "Set node labels",
            "type": "string_match",
            "details": {
                "query": "match (b) set b:Other return b",
                "complexity": 3.0
            }
        },
        {
            "name": "Set multiple node properties",
            "type": "string_match",
            "details": {
                "query": "match (b) set b.name = '123', b.other = '123' return b",
                "complexity": 3.0
            }
        },
        {
            "name": "Set multiple node properties with multiple updating clauses",
            "type": "string_match",
            "details": {
                "query": "match (b) set b.name = '123' set b:Label return b",
                "complexity": 3.0
            }
        },
        {
            "name": "Delete node",
            "type": "string_match",
            "details": {
                "query": "match (b) delete b return b",
                "complexity": 3.0
            }
        },
        {
            "name": "Delete detach node",
            "type": "string_match",
            "details": {
                "query": "match (b) detach delete b return b",
                "complexity": 3.0
            }
        },
        {
            "name": "Delete detach nodes",
            "type": "string_match",
            "details": {
                "query": "match (a), (b) detach delete a, b return b",
                "complexity": 7.0
            }
        },
        {
            "name": "Create node",
            "type": "string_match",
            "details": {
                "query": "create (a:Label {p: '1234'}) return a",
                "complexity": 1.0
            }
        },
        {
            "name": "Create node with decimal properties parameter",
            "type": "string_match",
            "details": {
                "query": "create (a:Label $1) return a",
                "complexity": 1.0
            }
        },
        {
            "name": "Create node with named properties parameter",
            "type": "string_match",
            "details": {
                "query": "create (a:Label $named) return a",
                "complexity": 1.0
            }
        },
        {
            "name": "Create multiple nodes",
            "type": "string_match",
            "details": {
                "query": "create (a:Label {p: '1234'}), (b:Other) return a, b",
                "complexity": 3.0
            }
        },
        {
            "name": "Create relationship",
            "type": "string_match",
            "details": {
                "query": "create p = (:Label {p: '1234'})-[:Link {r: 1234}]->(b {p: '4321'}) return p",
                "complexity": 4.0
            }
        },
        {
            "name": "Create relationship with decimal properties parameter",
            "type": "string_match",
            "details": {
                "query": "create p = (:Label {p: '1234'})-[:Link $1]->(b {p: '4321'}) return p",
                "complexity": 4.0
            }
        },
        {
            "name": "Create relationship with named properties parameter",
            "type": "string_match",
            "details": {
                "query": "create p = (:Label {p: '1234'})-[:Link $named]->(b {p: '4321'}) return p",
                "complexity": 4.0
            }
        },
        {
            "name": "Create relationship with matching",
            "type": "string_match",
            "details": {
                "query": "match (a), (b) where a.name = 'a' and b.linked = id(a) create p = (a)-[:Linked]->(b) return p",
                "complexity": 11.0
            }
        },
        {
            "name": "Remove node properties",
            "type": "string_match",
            "details": {
                "query": "match (b) remove b.name return b",
                "complexity": 3.0
            }
        },
        {
            "name": "Remove multiple node properties",
            "type": "string_match",
            "details": {
                "query": "match (b) remove b.name, b.other return b",
                "complexity": 3.0
            }
        },
        {
            "name": "Remove multiple node properties with multiple updating clauses",
            "type": "string_match",
            "details": {
                "query": "match (b) remove b.name remove b:Label return b",
                "complexity": 1.0
            }
        },
        {
            "name": "Single nodes",
            "type": "string_match",
            "details": {
                "query": "match (b) return b",
                "complexity": 3.0
            }
        },
        {
            "name": "Multiple nodes",
            "type": "string_match",
            "details": {
                "query": "match (a), (b {prop: a.name}) return a, b",
                "complexity": 7.0
            }
        },
        {
            "name": "Conjunction",
            "type": "string_match",
            "details": {
                "query": "match (n) where n.indexed >= 1 and n.other_1 = 2 return n",
                "complexity": 3.0
            }
        },
        {
            "name": "Multiple conjunctions",
            "type": "string_match",
            "details": {
                "query": "match (n) where n.indexed >= 1 and n.other_1 = 2 and n.other_2 = 3 return n",
                "complexity": 3.0
            }
        },
        {
            "name": "Conjunction with disjunction",
            "type": "string_match",
            "details": {
                "query": "match (n) where n.indexed >= 1 and (n.other_1 = 2 or n.other_2 = 3) return n",
                "complexity": 3.0
            }
        },
        {
            "name": "Disjunction",
            "type": "string_match",
            "details": {
                "query": "match (n) where (n.indexed >= 1 or n.other_1 = 2) return n",
                "complexity": 3.0
            }
        },
        {
            "name": "Multiple disjunctions",
            "type": "string_match",
            "details": {
                "query": "match (n) where (n.indexed >= 1 or n.other_1 = 2 or n.other_2 = 3) return n",
                "complexity": 3.0
            }
        },
        {
            "name": "String predicate starts with",
            "type": "string_match",
            "details": {
                "query": "match (n) where n.name starts with '123' return n",
                "complexity": 3.0
            }
        },
        {
            "name": "String predicate contains",
            "type": "string_match",
            "details": {
                "query": "match (n) where n.name contains '123' return n",
                "complexity": 3.0
            }
        },
        {
            "name": "String predicate ends with",
            "type": "string_match",
            "details": {
                "query": "match (n) where n.name ends with '123' return n",
                "complexity": 3.0
            }
        },
        {
            "name": "Match node by ID",
            "type": "string_match",
            "details": {
                "query": "match (n) where id(n) = 1 return n",
                "complexity": 3.0
            }
        },
        {
            "name": "Match patterns with range literal",
            "type": "string_match",
            "details": {
                "query": "match (n)-[:NestedEdge*]->() where id(n) = 1 return n",
                "complexity": 9.0
            }
        },
        {
            "name": "Match patterns with range literal",
            "type": "string_match",
            "details": {
                "query": "match (n)-[:NestedEdge*1..]->() where id(n) = 1 return n",
                "complexity": 9.0
            }
        },
        {
            "name": "Match patterns with range literal",
            "type": "string_match",
            "details": {
                "query": "match (n)-[:NestedEdge*1..2]->() where id(n) = 1 return n",
                "complexity": 7.0
            }
        },
        {
            "name": "Match patterns with where and return clauses",
            "type": "string_match",
            "details": {
                "query": "match (n {property: true})<-[r {property: n.name}]-(s)-[v]->() where n.indexed = false return n, r.other",
                "complexity": 13.0
            }
        },
        {
            "name": "Match distinct",
            "type": "string_match",
            "details": {
                "query": "match (n) return distinct n",
                "complexity": 4.0
            }
        },
        {
            "name": "Match skip and limit",
            "type": "string_match",
            "details": {
                "query": "match (n) return n skip 1 limit 1",
                "complexity": 3.0
            }
        },
        {
            "name": "Match order by",
            "type": "string_match",
            "details": {
                "query": "match (n) return n order by n.name asc, n.other desc",
                "complexity": 5.0
            }
        },
        {
            "name": "Find All Domain Admins",
            "type": "string_match",
            "details": {
                "query": "match p = (n:Group)<-[:MemberOf*1..]-(m) where n.objectid =~ '(?i)S-1-5-.*-512' return p",
                "complexity": 8.0
            }
        },
        {
            "name": "Map Domain Trusts",
            "type": "string_match",
            "details": {
                "query": "match p = (n:Domain)-[]->(m:Domain) return p",
                "complexity": 4.0
            }
        },
        {
            "name": "Find principals with DCSync rights",
            "type": "string_match",
            "details": {
                "query": "match p = ()-[:DCSync|AllExtendedRights|GenericAll]->(:Domain {name: 'DOMAIN.PAIN'}) return p",
                "complexity": 4.0
            }
        },
        {
            "name": "Users with Foreign Domain Group Membership",
            "type": "string_match",
            "details": {
                "query": "match p = (n:User)-[:MemberOf]->(m:Group) where n.domain = 'DOMAIN.PAIN' and m.domain <> n.domain return p",
                "complexity": 2.0
            }
        },
        {
            "name": "Groups with Foreign Domain Group Membership",
            "type": "string_match",
            "details": {
                "query": "match p = (n:Group {domain: 'DOMAIN.PAIN'})-[:MemberOf]->(m:Group) where m.domain <> n.domain and n.name <> m.name return p",
                "complexity": 2.0
            }
        },
        {
            "name": "Find Computers where Domain Users are Local Admin",
            "type": "string_match",
            "details": {
                "query": "match p = (m:Group {name: 'DOMAIN USERS@DOMAIN.PAIN'})-[:AdminTo]->(n:Computer) return p",
                "complexity": 2.0
            }
        },
        {
            "name": "Find Computers where Domain Users can read LAPS passwords",
            "type": "string_match",
            "details": {
                "query": "match p = (Group {name: 'DOMAIN USERS@DOMAIN.PAIN'})-[:MemberOf*0..]->(g:Group)-[:AllExtendedRights|ReadLAPSPassword]->(n:Computer) return p",
                "complexity": 8.0
            }
        },
        {
            "name": "Find All Paths from Domain Users to High Value Targets",
            "type": "string_match",
            "details": {
                "query": "match p = shortestPath((g:Group {name: 'DOMAIN USERS@DOMAIN.PAIN'})-[*1..]->(n {highvalue: true})) where g <> n return p",
                "complexity": 10.0
            }
        },
        {
            "name": "Find all shortest paths to workstations where Domain Users can RDP",
            "type": "string_match",
            "details": {
                "query": "match p = allShortestPaths((g:Group {name: 'DOMAIN USERS@DOMAIN.PAIN'})-[:CanRDP]->(c:Computer)) where not (c.operatingsystem contains 'Server') return p",
                "complexity": 4.0
            }
        },
        {
            "name": "Find Workstations where Domain Users can RDP",
            "type": "string_match",
            "details": {
                "query": "match p = (g:Group {name: 'DOMAIN USERS@DOMAIN.PAIN'})-[:CanRDP]->(c:Computer) where not (c.operatingsystem contains 'Server') return p",
                "complexity": 2.0
            }
        },
        {
            "name": "Find Servers where Domain Users can RDP",
            "type": "string_match",
            "details": {
                "query": "match p = (g:Group {name: 'DOMAIN USERS@DOMAIN.PAIN'})-[:CanRDP]->(c:Computer) where c.operatingsystem contains 'Server' return p",
                "complexity": 2.0
            }
        },
        {
            "name": "Find Dangerous Privileges for Domain Users Groups",
            "type": "string_match",
            "details": {
                "query": "match p = (m:Group)-[:Owns|WriteDacl|GenericAll|WriteOwner|ExecuteDCOM|GenericWrite|AllowedToDelegate|ForceChangePassword]->(n:Computer) where m.objectid ends with '-513' return p",
                "complexity": 2.0
            }
        },
        {
            "name": "Find Domain Admins Logons to non-Domain Controllers",
            "type": "string_match",
            "details": {
                "query": "match (dc)-[r:MemberOf*0..]->(g:Group) where g.objectid ends with '-516' with collect(dc) as exclude match p = (c:Computer)-[n:HasSession]->(u:User)-[r2:MemberOf*1..]->(g:Group) where g.objectid ends with '-512' and not (c in exclude) return p",
                "complexity": 17.0
            }
        },
        {
            "name": "Support add expressions",
            "type": "string_match",
            "details": {
                "query": "match (n) return n.value + n.other_value as combined",
                "complexity": 3.0
            }
        },
        {
            "name": "Support subtract expressions",
            "type": "string_match",
            "details": {
                "query": "match (n) return n.value - n.other_value as combined",
                "complexity": 3.0
            }
        },
        {
            "name": "Support multiply expressions",
            "type": "string_match",
            "details": {
                "query": "match (n) return n.value * n.other_value as combined",
                "complexity": 3.0
            }
        },
        {
            "name": "Support divide expressions",
            "type": "string_match",
            "details": {
                "query": "match (n) return n.value / n.other_value as combined",
                "complexity": 3.0
            }
        },
        {
            "name": "Support modulo expressions",
            "type": "string_match",
            "details": {
                "query": "match (n) return n.value % n.other_value as combined",
                "complexity": 3.0
            }
        },
        {
            "name": "Support power of expressions",
            "type": "string_match",
            "details": {
                "query": "match (n) return n.value ^ n.other_value as combined",
                "complexity": 3.0
            }
        },
        {
            "name": "Support complex unary expressions",
            "type": "string_match",
            "details": {
                "query": "match (n) return 1 - 2 / 2 * 100 as combined",
                "complexity": 3.0
            }
        },
        {
            "name": "Support complex arithmetic expressions",
            "type": "string_match",
            "details": {
                "query": "match (n) return 1 + 2 % 3 + n.prop_1 ^ n.prop_2 - 300.124 / 2 * 100 as combined",
                "complexity": 3.0
            }
        },
        {
            "name": "Find Kerberoastable Users with most privileges",
            "type": "string_match",
            "details": {
                "query": "match (u:User {hasspn: true}) optional match (u)-[:AdminTo]->(c1:Computer) optional match (u)-[:MemberOf*1..]->(:Group)-[:AdminTo]->(c2:Computer) with u, collect(c1) + collect(c2) as tempVar unwind tempVar as comps return u.name, count(distinct (comps)) order by count(distinct (comps)) desc",
                "complexity": 18.0
            }
        },
        {
            "name": "Find Kerberoastable Members of High Value Groups",
            "type": "string_match",
            "details": {
                "query": "match p = shortestPath((n:User)-[:MemberOf]->(g:Group)) where g.highvalue = true and n.hasspn = true return p",
                "complexity": 3.0
            }
        },
        {
            "name": "Shortest Paths to Unconstrained Delegation Systems",
            "type": "string_match",
            "details": {
                "query": "match p = shortestPath((n)-[:HasSession|AdminTo|Contains|AZLogicAppContributor*1..]->(m:Computer {unconstraineddelegation: true})) where not (n = m) return p",
                "complexity": 9.0
            }
        },
        {
            "name": "Shortest Paths from Kerberoastable Users",
            "type": "string_match",
            "details": {
                "query": "match p = shortestPath((n)-[:HasSession|AdminTo|Contains|AZLogicAppContributor*1..]->(m:Computer {unconstraineddelegation: true})) where not (n = m) return p",
                "complexity": 9.0
            }
        },
        {
            "name": "Shortest Paths to Domain Admins from Kerberoastable Users",
            "type": "string_match",
            "details": {
                "query": "match p = shortestPath((n:User {hasspn: true})-[:HasSession|AdminTo|Contains|AZLogicAppContributor*1..]->(m:Group {name: 'DOMAIN ADMINS@DOMAIN.PAIN'})) return p",
                "complexity": 7.0
            }
        },
        {
            "name": "Shortest Paths from Owned Principals",
            "type": "string_match",
            "details": {
                "query": "match p = shortestPath((n:User {hasspn: true})-[:HasSession|AdminTo|Contains|AZLogicAppContributor*1..]->(m:Group {name: 'DOMAIN ADMINS@DOMAIN.PAIN'})) return p",
                "complexity": 7.0
            }
        },
        {
            "name": "Shortest Paths to High Value Targets",
            "type": "string_match",
            "details": {
                "query": "match p = shortestPath((n)-[*1..]->(m {highvalue: true})) where m.domain = 'DOMAIN.PAIN' and m <> n return p",
                "complexity": 12.0
            }
        },
        {
            "name": "Return All Matches",
            "type": "string_match",
            "details": {
                "query": "match (a:Person), (b:Company), (c:LegalFirm) return *",
                "complexity": 6.0
            }
        },
        {
            "name": "Shortest Paths from Domain Users to High Value Targets",
            "type": "string_match",
            "details": {
                "query": "match p = shortestPath((g:Group {name: 'DOMAIN USERS@DOMAIN.PAIN'})-[*1..]->(n {highvalue: true})) where g.objectid ends with '-513' and g <> n return p",
                "complexity": 10.0
            }
        },
        {
            "name": "Find Shortest Paths to Domain Admins",
            "type": "string_match",
            "details": {
                "query": "match p = shortestPath((n)-[:HasSession|AdminTo|Contains|AZLogicAppContributor*1..]->(m:Group {name: 'DOMAIN ADMINS@DOMAIN.PAIN'})) where not (n = m) return p",
                "complexity": 9.0
            }
        },
        {
            "name": "Find Shortest Paths to Domain Admins with Traversal Limit",
            "type": "string_match",
            "details": {
                "query": "match p = shortestPath((n)-[:HasSession|AdminTo|Contains|AZLogicAppContributor*5..1]->(m:Group {name: 'DOMAIN ADMINS@DOMAIN.PAIN'})) where not (n = m) return p",
                "complexity": 7.0
            }
        },
        {
            "name": "Find Computers with Unsupported Operating Systems",
            "type": "string_match",
            "details": {
                "query": "match (n:Computer) where n.operatingsystem =~ '(?i).*(2000|2003|2008|xp|vista|7|me).*' return n",
                "complexity": 2.0
            }
        },
        {
            "name": "List All Kerberoastable Accounts",
            "type": "string_match",
            "details": {
                "query": "match (n:User) where n.hasspn = true return n",
                "complexity": 1.0
            }
        },
        {
            "name": "Find AS-REP Roastable Users (DontReqPreAuth)",
            "type": "string_match",
            "details": {
                "query": "match (u:User {dontreqpreauth: true}) return u",
                "complexity": 1.0
            }
        }
    ]
}
